CVE-2018-1000124

CRITICAL 10.0CVE-2018-1000124 · Published 13/03/2018 · updated 17/06/2026

In short

CVE-2018-1000124 is a CRITICAL (CVSS 10.0) vulnerability affecting i, librarian (scilico).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
i, librarian scilico	`≤ 4.8`	No fix yet

Description

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea.

References

mkucej/i-librarian · Exploit

More vulnerabilities in i, librarian

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

i, librarian

scilico

≤ 4.8

No fix yet

Description

More vulnerabilities in i, librarian

See all →